Failure of Anti-Keyloggers

[aigle]

Martin,s Undetectable Keylogger

hxxp://www.geocities.com/martinisthebest1703/
( change hxxp to http)

For Modes-- pls it is not a link to a malware( this keylogger is just a test software).

I tried this keylogger against following security softwares.

ZA Pro
Online Armor
SpySweeper
SpywareDoctor
WindowsDefender
SnoopFree
Bazooka scanner

To my surprize, none of them was able to detect this key logger. Only programme that detected thsi KeyLogger was KL-Detector

hxxp://dewasoft.com/privacy/kldetector.htm

and it was able to detect the keylogger as it uses a different technique to detect the key loggers. I just wonder if there is a real good Anti-Key Logger software that can be relied upon.

[MikeNash]

{QUOTE-> Martin,s Undetectable Keylogger

hxxp://www.geocities.com/martinisthebest1703/
( change hxxp to http)

For Modes-- pls it is not a link to a malware( this keylogger is just a test software).

I tried this keylogger against following security softwares.

ZA Pro
Online Armor
SpySweeper
SpywareDoctor
WindowsDefender
SnoopFree
Bazooka scanner

To my surprize, none of them was able to detect this key logger. Only programme that detected thsi KeyLogger was KL-Detector

hxxp://dewasoft.com/privacy/kldetector.htm

and it was able to detect the keylogger as it uses a different technique to detect the key loggers. I just wonder if there is a real good Anti-Key Logger software that can be relied upon. <-QUOTE}

muk repeatedly polls "getKeyState" - it's not a very reliable method and it can be defeated simply by typing quickly.

The new OA Kernel mode driver detects keyloggers that use this method.

[rdsu]

aigle,

you should make this test using only programs that detects key logger behaviours and not programs that detect key loggers by signature, like SpySweeper, SpywareDoctor, WindowsDefender, Bazooka scanner... ;)

[StevieO]

BOClean detects it and has for some time, as " someone " sent it to them !


StevieO

[spindoctor]

There was an older thread around here somewhere in which some of the members here did some keylogger tests with Martin's Undetectable Keylogger. I remember Security task manager being one of the programs that could find it too, along with Boclean. But it really is just a test program. It's not like it's hidden like a real keylogger would be, so why should it be detected?

[Bubba]

{QUOTE-> It's not like it's hidden like a real keylogger would be, so why should it be detected? <-QUOTE}There's no reason it should be especially by the programs or method used in testing.

[aigle]

Actually I expected ZA Pro, OA and SnoopFree to detect it as they are based upon behaviour.

[MikeNash]

{QUOTE-> Actually I expected ZA Pro, OA and SnoopFree to detect it as they are based upon behaviour. <-QUOTE}

Yep. I had code to detect this behavior ages ago - but because it's not particularly reliable method of keylogging I treated it as a low priority and scheduled it to be included in Kernel mode.

[aigle]

BTW as u said, I tried to defeat it by rapid typing but no success.

[aigle]

I have no knowledge of Keyloggers but I just think that even if a key logging method is not reliable, it should be detectable( correct?)as I can see on my system it is recording every single click.